At the end of 2019, Federal Law No. 405-FZ1 entered into force. This act has significantly increased administrative liability for violations of the requirements on the localization of databases containing personal data of Russian nationals. We already wrote about this amendment earlier.
The new provisions have significantly increased the amount of fines for violation of requirements for the personal data localization. At the moment the maximum fine may be as high as RUB 18 million.
As early as on February 13, 2020, under the new regulation, the first fines were imposed for refusal to provide information about the fact that Russian users data is contained on servers physically located in Russia. The Magistrate of the Tagansky District of Moscow held Facebook and Twitter liable for violating personal data law, namely, for violating the requirements on the personal data localization. Each company was fined RUB 4 million.
At the same time, the payment of a fine does not exempt these companies from the obligation to localize databases with personal data of Russian nationals. In case of failure to fulfill this obligation, the companies may be re-fined up to RUB 18 million. In case of failure to fulfill the obligation to localize databases after paying the repeated fine, Facebook and Twitter will face a block in Russia, as was the case with the social network LinkedIn.
It is noteworthy that in April, 2019, Facebook and Twitter were held liable by the same court for violating the requirements on the personal data localization. At that time, companies were fined in the amount of RUB 3 thousand each and also were given 9 months to eliminate the violations. But due to the fact that the companies refused to eliminate the violation within the time limit provided by the court, Roskomnadzor drew up a protocol on an administrative offense and submitted it to the court.
Numerous attempts by Twitter to appeal the court’s decision on fines to the Tagansky District Court, the Moscow City Court and the Supreme Court of the Russian Federation were also unsuccessful.
The court position demonstrates that legal provisions with new fines are not a formality, while Roskomnadzor intends to closely monitor compliance with localization requirements and hold violators liable. Thus, companies that have not localized databases with personal data of Russian nationals yet need to initiate the databases` transfer to the territory of Russia in the nearest future.
1 Federal Law No. 405-FZ dated December 2, 2019 “On Amending Certain Legislative Acts of the Russian Federation”